First release candidate of PowerDNS DNSdist 2.0.0

[rgacogne]

https://blog.powerdns.com/2025/07/08/first-release-candidate-of-powerdns-dnsdist-2.0.0

[paddg]

Report on building on SuSE

I had a few small problems while building:

[   68s] configure: 
[   68s] + make -j4 -j2
[   68s] ./incfiles . > htmlfiles.h.tmp
[   68s] echo 'R"FFIContent(' > dnsdist-lua-ffi-interface.inc
[   68s] Actions or selectors definitions have changed, python is needed to regenerate the related files but python was not found. Please install python and re-run configure
[   68s] make: *** [Makefile:3030: dnsdist-rust-bridge-actions-generated-body.hh] Error 1

I added this line in the spec file:

BuildRequires: python3

Another error:

[   66s] configure: 
[   66s] + make -j4 -j2
[   66s] ./incfiles . > htmlfiles.h.tmp
[   66s] echo 'R"FFIContent(' > dnsdist-lua-ffi-interface.inc
[   66s] /usr/bin/python3 dnsdist-rules-generator.py . .
[   66s] Traceback (most recent call last):
[   66s]   File "dnsdist-rules-generator.py", line 38, in <module>
[   66s]     import yaml
[   66s] ModuleNotFoundError: No module named 'yaml'
[   66s] make: *** [Makefile:3032: dnsdist-rust-bridge-actions-generated-body.hh] Error 1

I added this line in the spec file:

BuildRequires: python3-PyYAML

Another error:

[  599s] libtool: link: g++-11 -std=c++17 -fPIE -DPIE -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -g -O3 -Wall -Wextra -Wshadow -Wmissing-declarations -Wredundant-decls -fvisibility=hidden -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g -pie -Wl,-z -Wl,relro -Wl,-z -Wl,now -rdynamic -o dnsdist bpf-filter.o capabilities.o channel.o coverage.o credentials.o dns.o dnscrypt.o dnsdist-actions-factory.o dnsdist-actions.o dnsdist-async.o dnsdist-backend.o dnsdist-cache.o dnsdist-carbon.o dnsdist-concurrent-connections.o dnsdist-configuration-yaml.o dnsdist-configuration.o dnsdist-console-completion.o dnsdist-console.o dnsdist-crypto.o dnsdist-discovery.o dnsdist-dnscrypt.o dnsdist-dnsparser.o dnsdist-dnsquestion.o dnsdist-doh-common.o dnsdist-dynblocks.o dnsdist-dynbpf.o dnsdist-ecs.o dnsdist-edns.o dnsdist-frontend.o dnsdist-healthchecks.o dnsdist-idstate.o dnsdist-internal-queries.o dnsdist-kvs.o dnsdist-lbpolicies.o dnsdist-lua-actions.o dnsdist-lua-bindings-dnscrypt.o dnsdist-lua-bindings-dnsparser.o dnsdist-lua-bindings-dnsquestion.o dnsdist-lua-bindings-kvs.o dnsdist-lua-bindings-network.o dnsdist-lua-bindings-packetcache.o dnsdist-lua-bindings-protobuf.o dnsdist-lua-bindings-rings.o dnsdist-lua-bindings.o dnsdist-lua-configuration-items.o dnsdist-lua-ffi.o dnsdist-lua-hooks.o dnsdist-lua-inspection-ffi.o dnsdist-lua-inspection.o dnsdist-lua-network.o dnsdist-lua-rules.o dnsdist-lua-vars.o dnsdist-lua-web.o dnsdist-lua.o dnsdist-mac-address.o dnsdist-metrics.o dnsdist-protobuf.o dnsdist-protocols.o dnsdist-proxy-protocol.o dnsdist-query-count.o dnsdist-random.o dnsdist-resolver.o dnsdist-rings.o dnsdist-rule-chains.o dnsdist-rules.o dnsdist-secpoll.o dnsdist-self-answers.o dnsdist-session-cache.o dnsdist-snmp.o dnsdist-svc.o dnsdist-systemd.o dnsdist-tcp-downstream.o dnsdist-tcp.o dnsdist-web.o dnsdist-xsk.o dnsdist.o dnslabeltext.o dnsname.o dnsparser.o dnstap.o dnswriter.o doh3.o dolog.o ednscookies.o ednsextendederror.o ednsoptions.o ednssubnet.o ext/json11/json11.o fstrm_logger.o gettime.o iputils.o libssl.o misc.o pollmplexer.o protozero.o proxy-protocol.o qtype.o remote_logger.o remote_logger_pool.o snmp-agent.o statnode.o svc-records.o tcpiohandler.o threadname.o uuid-utils.o xsk.o ipcipher.o dnsdist-nghttp2-in.o dnsdist-nghttp2.o epollmplexer.o dnsdist-configuration-yaml-items-generated.o  -lluajit-5.1 -ledit ./ext/yahttp/yahttp/.libs/libyahttp.a -lsodium -lfstrm -lsystemd ./ext/ipcrypt/.libs/libipcrypt.a ./ext/arc4random/.libs/libarc4random.a -lre2 -lssl -lcrypto -lgnutls -lnghttp2 ./dnsdist-rust-lib/rust/libdnsdist_rust.a -lpthread -pthread
[  599s] /usr/lib64/gcc/x86_64-suse-linux/11/../../../../x86_64-suse-linux/bin/ld: ./dnsdist-rust-lib/rust/libdnsdist_rust.a(std-5c3fcc0e31ce8a7a.std.442bdc82062d6ae0-cgu.07.rcgu.o): undefined reference to symbol 'dlsym@@GLIBC_2.2.5'
[  599s] /usr/lib64/gcc/x86_64-suse-linux/11/../../../../x86_64-suse-linux/bin/ld: /lib64/libdl.so.2: error adding symbols: DSO missing from command line
[  599s] collect2: error: ld returned 1 exit status
[  599s] make[2]: *** [Makefile:1743: dnsdist] Error 1
[  599s] make[2]: Leaving directory '/home/abuild/rpmbuild/BUILD/dnsdist-2.0.0-rc1'
[  599s] make[1]: *** [Makefile:2074: all-recursive] Error 1
[  599s] make[1]: Leaving directory '/home/abuild/rpmbuild/BUILD/dnsdist-2.0.0-rc1'
[  599s] make: *** [Makefile:1623: all] Error 2

I added this line in the spec file:

export LIBS="$LIBS -ldl"

Then the build process was successful :-)

[rgacogne]

Hello Winfried! The first two are expected, since even when shipping pre-generated files the build system sometimes has to generate them again because of the timestamps on the filesystem, which is why we have documented that building DNSdist now requires python(3) and python(3)-yaml. The last one is something we need to fix, though! I'm 99% sure I have seen that before but it's possible we fixed when building with meson and not when building with autotools, I'll look into it. Many thanks!

[paddg]

Performance Considerations

It looks to me like dnsdist 2.0 can accept approximately 3% to 6% fewer QPS than dnsdist 1.9.10. I tested with our complete configuration, which is relatively large. I enabled and disabled various features, which had no effect on the results. The test queries were all answered from the dnsdist package cache, so it was purely a front-end test. Perhaps you have the opportunity to verify this with a simple setup. It might be due to a specific feature we're using, but it would be interesting to know if 2.0 has a general performance loss.

[rgacogne]

Hi! Well, that's not good. I did a lot of performance testing when we introduced the "big" changes for 2.0 but perhaps some innocuous-looking change introduced later in the process caused a regression. I'll re-do the performance tests and keep you updated. Thanks a lot!

[rgacogne]

Just to keep you updated, I have reproduced a small performance regression in a test at 100% CHR. In my tests it's lower than 3% which makes it a bit hard to distinguish from network noise, but I can confirm it's there. I have a promising patch, but it's too late to integrate it into rc2 that we are releasing today. I plan to fix the regression before 2.0.0, and I already intended to focus on performance for 2.1 so I might backport improvements to 2.0.x if needed.

[rgacogne]

To keep you updated, we are going to integrate a few performance improvements before 2.0.0:

• dnsdist-2.0.x: Backport 15868 - Improve the scalability of the MAC address cache #15876
• dnsdist-2.0.x: Backport 15869 - Small speedup for getEDNSUDPPayloadSizeAndZ() #15877
• dnsdist-2.0.x: Backport 15870 - Avoid constructing a DNSResponse object when not really needed #15878
• dnsdist-2.0.x: Backport 15871 - Use an unordered map for pools #15879
• dnsdist-2.0.x: Backport 15872 - Only parse EDNS Z once #15880

These are fixing some performance regressions introduced since 1.9.x. Another performance regression will be tackled by #15874 but we feel it is too big a change to introduce before 2.0.0, so we will take the time to review it properly and we plan on including it in 2.0.1. We also have bigger performance improvements planned for 2.1 which will be possible thanks to the configuration refactoring work done for 2.0.

[paddg]

Very good, thanks for letting me know! We will do new tests when 2.0.1 with #15874 is released.